VYPR
← All advisories
Unrated severityNVD Advisory· Published Oct 5, 2007· Updated Jun 16, 2026

CVE-2007-5228

CVE-2007-5228

Description

Cross-site scripting (XSS) vulnerability in the subscription functionality in the Project issue tracking module before 4.7.x-1.5, 4.7.x-2.x before 4.7.x-2.5, and 5.x-1.x before 5.x-1.1 for Drupal allows remote authenticated users with project create or edit permissions to inject arbitrary web script or HTML via unspecified vectors involving a (1) individual or (2) overview form.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

8
  • Drupal/Project Issue Tracking Module7 versions
    cpe:2.3:a:drupal:drupal_project_issue_tracking:4.7_1.0:*:*:*:*:*:*:*+ 6 more
    • cpe:2.3:a:drupal:drupal_project_issue_tracking:4.7_1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal_project_issue_tracking:4.7_1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal_project_issue_tracking:4.7_2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal_project_issue_tracking:4.7_2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal_project_issue_tracking:4.7_2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal_project_issue_tracking:5.0_0.1:*:*:*:*:*:*:*
    • (no CPE)range: <4.7.x-1.5, <4.7.x-2.5, <5.x-1.1
  • Drupal/Drupalllm-fuzzy
    Range: <4.7.x-1.5, <4.7.x-2.5, <5.x-1.1

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.